Multiple IdPs *with* discovery

[Cantor, Scott]

On 3/24/14, 4:07 PM, "Rob Gorrell" <rwgorrel at uncg.edu> wrote:

>So I've been following the "Multiple IdPs without discovery" thread and
>the use of the ShibRequestSetting ...it has me wondering, how are
>multiple IdP's handled in the federated sense, when discovery *is*
>involved? What I mean more precisely is, how multiple
> IdP's for a single organization are handled during discovery? Say we
>have IdP's at two sites authenticating the same populations for
>redundancy, but only want users presented with a single option for the
>entire organization at discovery?

You don't have two IdPs there, you have one. You can't deploy separate
IdPs for "redundancy", that has to be handled behind the scenes. A browser
is only going to try one place, it can't know to try another.

> Does shibb provide
> mechanisms for addressing this? or would this typically be handled
>outside shibb using a network load balance to manage what shibb would
>view as a single organizational endpoint?

It doesn't have to be a load balancer, but there can only be one endpoint
tried, period. It's physically impossible to do anything else with a
browser unless the first endpoint just redirects to the second, which
isn't really going to work if the first is down.

-- Scott